﻿<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4625)  and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]]</Select>
  </Query>
</QueryList>